Legal
Privacy notice
This notice explains what personal data TaxUnderstood collects, why, who we share it with, how long we keep it and the rights you have. We've kept it short and in plain English. If anything is unclear, email us at hello@taxunderstood.co.uk.
1. Who we are
TaxUnderstood is run by Micreations Ltd, a company registered in England and Wales (company number 16797696), registered office 3rd Floor, 86-90 Paul Street, London EC2A 4NE. We are the controller of your personal data: we decide how and why it's used.
Contact us about anything in this notice at hello@taxunderstood.co.uk. We are not required to appoint a Data Protection Officer, so this inbox is the right place for every privacy question or request.
2. What we collect
- Your account
- Your email address and a password. The password is stored only as a secure hash by our database provider; we can't see it.
- Your questionnaire answers
- Details about your business: its name, postcode, legal structure, turnover band, staff numbers, what you sell and how, your plans, and anything you type in the free-text boxes. We also save the council and region we look up from your postcode.
- Your report
- The report we generate from your answers, and when it was generated.
- Alert settings and matches
- Whether you've asked for email alerts, how often, and the schemes we've matched to your business. To match schemes we keep a short business profile (name, sectors, structure, region, town, turnover band, VAT status, whether you employ staff, premises and rateable value band).
- Requests to talk to an accountant
- If you ask for a call back: your name, email, phone number (optional), business name and your message.
- Usage logs for fair use
- When you use an AI tool or generate a report we log the type of tool and the time, linked to your account. If you're signed out we log a one-way scrambled code (a hash) made from your IP address instead, so we can't read your IP address back from it.
- Documents you check
- If you use a tool that reads an HMRC letter you upload or paste, the text or image is sent for processing to produce an explanation. We don't store the letter.
You give us all of this directly. We don't buy data about you, and we don't use analytics, advertising or tracking cookies.
Please don't put sensitive information (for example about health, religion or criminal records) or other people's personal details in the free-text boxes. We don't need it to help you.
3. Why we use it and our lawful basis
UK data protection law says we must have a lawful basis for each use of your data. Here's ours.
| What we do | Lawful basis |
|---|---|
| Create and run your account, save your answers, generate and show your report, send account emails (confirm your address, reset your password) | Contract: we need it to provide the free service you signed up for (Article 6(1)(b) UK GDPR) |
| Send your answers to our AI provider to write your report, and look up your council from your postcode | Contract: it's how the report is made |
| Email you when new grants, council funding or VAT changes match your business | Consent (Article 6(1)(a) UK GDPR and the Privacy and Electronic Communications Regulations). Only if you tick the box. Untick it on your Account page or use the link in any alert email. |
| Pass your call-back request to an accountant so they can contact you | Steps you've asked us to take before any engagement (Article 6(1)(b) UK GDPR) |
| Log AI and report use to set fair daily limits, prevent abuse and keep the service free and available | Legitimate interests (Article 6(1)(f) UK GDPR). We keep only the minimum, use a hash instead of your IP address, and delete the logs after 90 days. |
| Keep records, deal with complaints and legal claims, and meet legal obligations | Legal obligation (Article 6(1)(c)) or legitimate interests |
You don't have to give us any of this information, but without an email address and password we can't create an account, and without your answers we can't write your report.
4. How the AI tools use your data
Your report and some tools are written by an AI model (Claude, provided by Anthropic). We send it the answers it needs, never your password. To find local funding it may search public websites using your council area and a description of your business.
Under Anthropic's commercial terms it may not train its models on what we send. We don't use your data to train any AI model either.
No automated decisions about you. The report is general guidance to help you have a better conversation with your accountant. It doesn't make any decision that has a legal or similarly significant effect on you: it doesn't approve or refuse anything, and nothing happens automatically as a result of it. Always check it against the official guidance it links to.
6. Transfers outside the UK
Some providers above are based in the USA or may access data from there. UK law allows these transfers only with safeguards. We rely on one of these:
- the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework), which applies where the US company is certified under it, or
- contracts approved under UK law: the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Anthropic's data processing terms, for example, include the UK Addendum.
Read more on the ICO's international transfers guidance and the UK-US data bridge on GOV.UK. Email us for a copy of the relevant safeguards.
7. How long we keep it
| Data | How long |
|---|---|
| Account, answers, reports, alert settings and matches, report history | Until you delete your account. Deleting removes them straight away from our live database. |
| Requests to talk to an accountant | 24 months from the request, then deleted automatically. They're kept separately from your account, so deleting your account doesn't delete them; email us if you want one removed sooner. |
| AI and report usage logs | 90 days, then deleted automatically |
| HMRC letters you upload or paste into a tool | Not stored by us. Used once to produce the explanation, then discarded. |
| Data saved in your browser | Until you clear it, sign out, or delete your account (see section 9) |
Copies in routine database backups are overwritten as those backups expire.
8. Your rights
You have the right to:
- Access: get a copy of your data. Signed in? Use Download my data on your Account page for an instant copy.
- Rectification: correct anything wrong. You can update your answers yourself at any time.
- Erasure: have your data deleted. Use Delete my account, or email us.
- Restriction: ask us to pause using your data while a concern is sorted out.
- Objection: object to anything we do based on legitimate interests.
- Portability: get the data you gave us in a machine-readable file (the download is a JSON file) and have it sent to someone else.
- Withdraw consent: turn off email alerts at any time. This doesn't affect anything we did before.
To use any right, email hello@taxunderstood.co.uk. It's free. We'll reply within one month, and may ask you to confirm your identity first, usually from the email address on your account.
10. Keeping your data safe
Data is encrypted in transit (HTTPS) and held in a UK data centre. Database rules make sure each signed-in user can only read their own records, and only a small number of authorised people can access the systems behind them.
11. Children
TaxUnderstood is for people running or setting up a business. It isn't intended for anyone under 18, and we don't knowingly collect children's data. If you think a child has given us data, email us and we'll delete it.
12. Complaints
If you're unhappy with how we've used your data, please tell us first at hello@taxunderstood.co.uk. We'll acknowledge your complaint within 30 days and tell you what we've done about it.
You also have the right to complain to the Information Commissioner's Office, the UK regulator: ico.org.uk/make-a-complaint.
13. Changes to this notice
We'll update this page if we change how we use your data, and change the date at the top. If a change is significant we'll tell you by email or in the app.